New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 719292 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Nov 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in avformat_find_stream_info

Project Member Reported by ClusterFuzz, May 8 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6666128347889664

Fuzzer: libfuzzer_media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  avformat_find_stream_info
  base::Callback<int
  void base::internal::ReturnAsParamAdapter<int>
  
Sanitizer: undefined (UBSAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6666128347889664


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org
Components: Infra>Git
Labels: Test-Predator-Correct-CLs M-59
Owner: tzik@chromium.org
Status: Assigned (was: Untriaged)
Assigning to the concern owner from Predator results --
Regression information is not available. The result is the blame information. 

Author: Diego Biurrun
Project: chromium-ffmpeg
Changelist: https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/50ecf15712354a1d5b3f4dc9a57ff90ed7ee9654
Time: Thu Jan 16 00:53:03 2014
The CL last changed line 3620 of file utils.c, which is stack frame 0. 

Author: tzik
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/ecb1b24070b8cbf7958f05ecad9373b979e212b9
Time: Tue Mar 21 07:25:54 2017
The CL last changed line 91 of file callback.h, which is stack frame 1. 

Author: tzik
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/6e42784f92a0b66a3eae584358ec4a8778bffa33
Time: Wed Apr 05 10:13:21 2017
The CL last changed line 20 of file post_task_and_reply_with_result_internal.h, which is stack frame 2. 

Author: tzik
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/99de02ba952b0a69291f81c5b8ca14d81cc1f74f
Time: Fri Jul 01 05:54:12 2016
The CL last changed line 164 of file bind_internal.h, which is stack frame 3. 

Author: tzik
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/ecb1b24070b8cbf7958f05ecad9373b979e212b9
Time: Tue Mar 21 07:25:54 2017
The CL last changed line 91 of file callback.h, which is stack frame 4. 

Author: tzik
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/6e42784f92a0b66a3eae584358ec4a8778bffa33
Time: Wed Apr 05 10:13:21 2017
The CL last changed line 45 of file post_task_and_reply_impl.cc, which is stack frame 5. 

Author: tzik
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/ee2487294417a82adfc854aa680c7765eef7494e
Time: Wed Jun 01 08:22:51 2016
The CL last changed line 361 of file bind_internal.h, which is stack frame 6.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/6e42784f92a0b66a3eae584358ec4a8778bffa33

@tzik -- Could you please look into the issue, kindly re-assign if this issue is not related to your changes.
Thank You.

Comment 2 by tzik@chromium.org, May 8 2017

Components: -Infra>Git Internals>Media>FFmpeg
Labels: -Test-Predator-Correct-CLs Test-Predator-Wrong QA-Triage-Wrong
Owner: ----
Status: Untriaged (was: Assigned)
Cc: tzik@chromium.org
tzik@, can you tell me why this bug is assigned to media>FFmpeg area? so I can re-assign more accurately.
Owner: jrumm...@chromium.org
Status: Assigned (was: Untriaged)
Should fix as part of ffmpeg roll for this milestone. Seems we just have the wrong return signature on our function.
Project Member

Comment 5 by ClusterFuzz, Oct 1 2017

Components: Internals>Core
Labels: Test-Predator-AutoComponents
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.
Owner: chcunningham@chromium.org
Chris, can you fix this as part of the ffmpeg roll?
Sure. 

Comment 8 by mmoroz@chromium.org, Oct 24 2017

For more information, please see https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md.

The link referenced in the description is no longer valid.

(bulk edit)
Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components
Project Member

Comment 10 by ClusterFuzz, Nov 18 2017

ClusterFuzz has detected this issue as fixed in range 517703:517710.

Detailed report: https://clusterfuzz.com/testcase?key=6666128347889664

Fuzzer: libFuzzer_media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  avformat_find_stream_info
  base::OnceCallback<int
  void base::internal::ReturnAsParamAdapter<int>
  
Sanitizer: undefined (UBSAN)

Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=517703:517710

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6666128347889664

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Nov 18 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6666128347889664 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment